Extract Files from Network Traffic AKA Carving
ID: be70a891-7f50-593c-b356-eeb38cb7ba17
STIX ID: report--be70a891-7f50-593c-b356-eeb38cb7ba17
Feed Name: Darknet
DumpBrowserSecrets is a post-exploitation credential-harvesting tool that extracts passwords, cookies, OAuth refresh tokens, credit card data, autofill entries and history from Chrome, Edge, Brave, Opera (and variants), Vivaldi, and Firefox by bypassing App-Bound Encryption (via DLL injection into a headless Chromium process and the IElevator COM interface), DPAPI, and NSS mechanisms; it includes operational evasion features, outputs structured JSON for red-team use, and is distributed as a precompiled Windows executable.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
